Which of the following services can alert you to malware on an EC2 instance?
A. AWS GuardDuty
B. AWS Inspector
C. AWS Shield
D. AWS Web Application Firewall
A. GuardDuty looks for potentially malicious activity.
Inspector looks for vulnerabilities that may result in compromise.
Shield and Web Application Firewall protect applications from attack.
What does GuardDuty monitor?
- VPC flow logs
- CloudTrail management event logs
- Route 53 DNS query logs
What is the target of GuardDuty findings?
- Inappropriate use of AWS credentials
- The presence of malware on an EC2 instance (e.g. Trojan, Cryptocurrency)
What is Amazon Inspector?
Amazon Inspector is an agent-based service that looks for vulnerabilities on your EC2 instance.
What is Amazon Detective?
Amazon Detective takes information from VPC flow logs, CloudTrail, and GuardDuty and places this information into a graph database.
Detective is designed to help you correlate events and see how a given event affects particular resources.
What is Security Hub?
Security Hub collects security information from various AWS services, including Inspector, GuardDuty, and Macie. In addition, Security Hub assesses your account against AWS security best practices and the Payment Card Industry Data Security Standard (PCI DSS).
What is the difference between AWS Sheild Standard and Advanced?
- Standard: defend against layer 3/4 DDoS attack
- Advanced: defend against layer 7 DDoS attack; protect specific EC2 instance, access to AWS DDoS team; AWS WAF is included at no charge
How long does it take for Shield to mitigate DDoS attacks?
- 99% attack is mitigated in 5 minutes or less
- Attacks against CloudFront and Route 53 is mitigated under 1 second
- Attack against ELB is under 5 minutes
- All other attack: 20 minutes
Can you directly encrypt a volume at rest?
No,
- Create a snapshot from the volume
- Copy the snapshot with encryption enabled.
- Create a new volume with the encrypted snapshot
What is Macie?
Macie is a service that automatically locates and classifies your sensitive data in S3 buckets?
Can you encrypt an existing EFS system?
No, the only option to encrypt the data using KMS is to create a new EFS filesystem and copy the data to it.
What is the typical DDoS attacks?
- Application layer (HTTP flood)
- Transport layer (SYN flood)
- DNS Amplification
